What can prevent overriding Access-Control-Allow-Origin in server?

There are more than one way to achieve this with multiple host. One is with .htaccess and the other is with php.

With .htaccess:

<IfModule mod_headers.c>    SetEnvIf Origin "http(s)?://(www\.)?(google.com|staging.google.com|development.google.com|otherdomain.example|dev02.otherdomain.example)$" AccessControlAllowOrigin=$0    Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin    Header merge Vary Origin</IfModule>

With PHP:

$origin = $_SERVER['HTTP_ORIGIN'];if ($origin == "http://www.domain1.com"        || $origin == "http://www.domain2.com"        || $origin == "http://www.domain3.com") {    header("Access-Control-Allow-Origin: $origin");}

The 'Access-Control-Allow-Origin' header contains multiple values 'www.theothersiteurl.com, *', but only one is allowed.

You have to be very careful to only set this header at one point. This can be done in 3 places:

• Core Apache config
• .htaccess
• PHP

I would recommend doing it inside the core Apache config, due to performance and security reasons.

However if you wish to achieve this using the .htaccess file then make sure nothing is modifying it in PHP and make sure AllowOverride is allowed in the <VirtualHost> block.